CVE-2026-40086: 
Python vulnerability analysis and mitigation

CVE-2026-40086 is a path traversal vulnerability in the rembg HTTP server that allows unauthenticated remote attackers to read arbitrary files from the server's filesystem. Rembg is a popular open-source Python tool (23k+ GitHub stars) used to remove image backgrounds. All versions prior to 2.0.75 are affected. The vulnerability was published on April 9–10, 2026, and patched in v2.0.75. It carries a CVSS v3.1 base score of 5.3 (Medium) (Github Advisory, Feedly).

The root cause is a security boundary violation classified as CWE-22 (Path Traversal) and CWE-73 (External Control of File Name or Path). The HTTP server's /api/remove endpoint accepts an extras JSON query parameter that is parsed and passed without validation to new_session(). When a custom model type (u2net_custom, dis_custom, or ben_custom) is selected, the model_path value from extras is passed to os.path.abspath(os.path.expanduser(model_path)) in the session's download_models() method with no path restriction checks. This resolved path is then fed directly to onnxruntime.InferenceSession(), which attempts to read and parse the file — leaking file existence, permissions, and partial contents through differentiated error messages (InvalidProtobuf vs. NoSuchFile vs. Permission denied) (Github Advisory, Patch Commit).

An unauthenticated network attacker can enumerate and partially read arbitrary files accessible to the rembg server process, including sensitive system files (/etc/passwd), environment files (.env), application configuration files, and credential stores. The error-message oracle enables filesystem enumeration (distinguishing file existence, readability, and content validity), which can facilitate credential discovery, infrastructure mapping, and preparation for further attacks. Integrity and availability are not directly impacted, but information disclosure can enable lateral movement or privilege escalation in broader environments. All deployments running rembg s in HTTP server mode are affected, including cloud and Docker-based deployments (Github Advisory).

A detailed proof-of-concept (PoC) with step-by-step reproduction instructions, including exact curl commands and Python scripts, is publicly available in the GitHub Security Advisory (Github Advisory). No authentication or special privileges are required; exploitation requires only network access to the rembg HTTP server. The EPSS score is approximately 0.049% (Feedly) to 0.074% (GitHub Advisory Database), placing it in the 23rd percentile. There is no evidence of active in-the-wild exploitation or threat actor attribution at this time, and the vulnerability is not listed in the CISA KEV catalog (Github Advisory, Feedly).

1. Reconnaissance: Identify internet-facing rembg HTTP server instances (default port 7000) using tools like Shodan or Censys, or by scanning for the /api documentation endpoint. Confirm the server is running a version prior to 2.0.75.
2. Prepare a minimal image: Create a minimal valid PNG file to satisfy the API's image upload requirement:

   python3 -c "import sys; sys.stdout.buffer.write(bytes([0x89,0x50,0x4E,0x47,...]))" > /tmp/test.png

3. Craft the exploit request: Construct a POST request to /api/remove with model=u2net_custom and an extras query parameter containing a JSON object with the target file path as model_path:

   curl -X POST 'http://<target>:7000/api/remove?extras=%7B%22model_path%22%3A%22%2Fetc%2Fpasswd%22%7D' \
     -F "model=u2net_custom" \
     -F "file=@/tmp/test.png"

4. Interpret error responses: Analyze the server's error response or server logs to determine file status — InvalidProtobuf confirms the file exists and was read; Permission denied confirms existence but restricted access; NoSuchFile confirms the file does not exist.
5. Enumerate sensitive files: Iterate over common sensitive paths (/etc/shadow, .env, ~/.ssh/id_rsa, application config files) to map the filesystem and discover credentials or configuration data (Github Advisory).

• Network: Unusual POST requests to /api/remove with URL-encoded extras parameter containing model_path values pointing to system paths (e.g., %2Fetc%2Fpasswd, %2Fetc%2Fshadow, .env); repeated requests with varying file paths suggesting enumeration activity.
• Logs: Server-side onnxruntime error messages such as [ONNXRuntimeError] : 7 : INVALID_PROTOBUF : Load model from /etc/passwd failed:Protobuf parsing failed or [ONNXRuntimeError] : 3 : NO_SUCHFILE : Load model from /nonexistent/file.txt failed; high volume of 422/500 HTTP responses to /api/remove.
• Process: onnxruntime attempting to open files outside the expected model directory (e.g., ~/.u2net/) as observed via process-level file access monitoring (e.g., auditd, strace) (Github Advisory).

Upgrade rembg to version 2.0.75 or later, which validates that model_path is within the allowed models directory before loading, preventing arbitrary file access (Patch Commit, v2.0.75 Release). If immediate upgrade is not possible, restrict network access to the rembg HTTP server to trusted hosts only using firewall rules or a reverse proxy with authentication. As an additional measure, consider disabling custom model types (u2net_custom, dis_custom, ben_custom) in the HTTP API by filtering them from the allowed model list in s_command.py (Github Advisory).

The vulnerability was reported by researcher yueyueL and published by the maintainer danielgatis via GitHub Security Advisories on April 9, 2026. The advisory received attention on Bluesky and was indexed by multiple vulnerability tracking services shortly after disclosure. No major media coverage or notable public researcher commentary beyond the advisory itself has been identified (Github Advisory).